High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIt was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash.
ComponentDOM
Bug ClassUAF
Tracker1944126
Fix commitb778e5e9455b (firefox) +10/-5
CISA KEVNot listed
Creditedsherkito
Disclosed2025-03-04

Changed Functions

FunctionChangeNotes
if
dom/webtransport/child/WebTransportChild.cpp
modified

Files Changed

  • dom/webtransport/child/WebTransportChild.cpp
diff --git a/dom/webtransport/child/WebTransportChild.cpp b/dom/webtransport/child/WebTransportChild.cpp
index 12714b003e9..e7c279398cf 100644
--- a/dom/webtransport/child/WebTransportChild.cpp
+++ b/dom/webtransport/child/WebTransportChild.cpp
@@ -34,7 +34,8 @@ void WebTransportChild::CloseAll() {
 ::mozilla::ipc::IPCResult WebTransportChild::RecvRemoteClosed(
     const bool& aCleanly, const uint32_t& aCode, const nsACString& aReason) {
   if (mTransport) {
-    mTransport->RemoteClosed(aCleanly, aCode, aReason);
+    RefPtr<WebTransport> self(mTransport);
+    self->RemoteClosed(aCleanly, aCode, aReason);
   }
   return IPC_OK();
 }
@@ -43,7 +44,8 @@ void WebTransportChild::CloseAll() {
     const uint64_t& aStreamId, const RefPtr<DataPipeReceiver>& aIncoming,
     const RefPtr<DataPipeSender>& aOutgoing) {
   if (mTransport) {
-    mTransport->NewBidirectionalStream(aStreamId, aIncoming, aOutgoing);
+    RefPtr<WebTransport> self(mTransport);
+    self->NewBidirectionalStream(aStreamId, aIncoming, aOutgoing);
   }
   return IPC_OK();
 }
@@ -51,7 +53,8 @@ void WebTransportChild::CloseAll() {
 ::mozilla::ipc::IPCResult WebTransportChild::RecvIncomingUnidirectionalStream(
     const uint64_t& aStreamId, const RefPtr<DataPipeReceiver>& aStream) {
   if (mTransport) {
-    mTransport->NewUnidirectionalStream(aStreamId, aStream);
+    RefPtr<WebTransport> self(mTransport);
+    self->NewUnidirectionalStream(aStreamId, aStream);
   }
   return IPC_OK();
 }
@@ -59,7 +62,8 @@ void WebTransportChild::CloseAll() {
 ::mozilla::ipc::IPCResult WebTransportChild::RecvIncomingDatagram(
     nsTArray<uint8_t>&& aData, const TimeStamp& aRecvTimeStamp) {
   if (mTransport) {
-    mTransport->NewDatagramReceived(std::move(aData), aRecvTimeStamp);
+    RefPtr<WebTransport> self(mTransport);
+    self->NewDatagramReceived(std::move(aData), aRecvTimeStamp);
   }
   return IPC_OK();
 }
@@ -67,7 +71,8 @@ void WebTransportChild::CloseAll() {
 ::mozilla::ipc::IPCResult WebTransportChild::RecvOnStreamResetOrStopSending(
     const uint64_t& aStreamId, const StreamResetOrStopSendingError& aError) {
   if (mTransport) {
-    mTransport->OnStreamResetOrStopSending(aStreamId, aError);
+    RefPtr<WebTransport> self(mTransport);
+    self->OnStreamResetOrStopSending(aStreamId, aError);
   }
   return IPC_OK();
 }
Loading diff…